The Update BureauKB5099414: Cumulative update for Windows 11, version 23H2, July 2026. Windows Shell spoofing flaw exploited; RDP adds SHA-2 support
In short
An actively exploited Windows Shell spoofing flaw is addressed. Trusted Remote Desktop publishers can now use SHA-2 certificate thumbprints.
Does it affect you? Applies to: Devices running Windows 11 version 23H2 on x64 or Arm64. Enterprise and Education editions reach the end of updates on November 10, 2026.
Review notes Additional details from the official release notes (3) Read notes
- In detail Some third-party apps that use OLE Automation to interact with Microsoft Office might fail to launch Office or open documents after the June 2026 security update. This update addresses the issue.
- What changes Applications that use sockets over unregistered third-party TDI transports might stop working after this update. Registered TDI transports are not affected.
- What changes Devices that have not received newer Secure Boot certificates will continue to start and operate normally, and standard Windows updates will continue to install.
The official sources are linked at the end of the page.
What changes
Improvements 6 changes
Secure Boot
Gradual rollout
Verified in package
For: most Windows devices; supported PCs and non-managed business devices
-
Secure Boot certificates used by most Windows devices are set to expire starting in June 2026. More eligible devices can receive newer certificates automatically.1
Adds high-confidence device-targeting data to increase coverage of devices eligible to receive new Secure Boot certificates automatically. Certificate delivery continues across supported PCs and non-managed business devices in the coming months.
Country and Operator Settings Asset (COSA)
Verified in package
- Profiles for certain mobile operators are brought up to date.2
Input
-
Windows changes how it cleans up keyboard shortcuts. In rare cases, some built-in features might temporarily stop responding to certain shortcuts.3
Changes hotkey unregister and cleanup behavior. Restarting the affected app can typically resolve the issue; if not, report it through Feedback Hub.
Networking
Verified in package
For: devices using unregistered third-party TDI transports
-
Some apps that use third-party network transports might stop working after this update. Apps using registered transports are not affected.4
Enforces TDI transport registration requirements. Applications that use sockets over unregistered third-party TDI transports might stop working.
Security
-
Windows includes a newer curl tool and security improvements to help protect your device.5
Upgrades the curl tool in Windows to version 8.21.0.
Servicing stack
-
The component that installs Windows updates gets quality improvements.6
Includes servicing stack update KB5104023, build 22621.7373.
Fixes 3 changes
Apps
-
Some third-party apps might fail to launch Office or open documents after the June 2026 security update. This update addresses the issue.7
Affects third-party apps that use OLE Automation to interact with Microsoft Office.
File Explorer
For: users running File Explorer as an administrator
-
The OneDrive shortcut in File Explorer works again when File Explorer runs as an administrator.8
Addresses an issue that might occur after installing the June 2026 security update.
Recycle Bin
-
When you permanently delete a file, the confirmation dialog shows its original name instead of an internal Recycle Bin name.9
Addresses an issue that might occur after installing the June 2026 security update.
New feature 1 change
Remote Desktop (RDP) Security
Verified in package
For: IT administrators managing trusted RDP publishers
-
Trusted Remote Desktop publishers can use SHA-2 certificate thumbprints. SHA-1 remains for backward compatibility but is planned for removal.10
Adds support for SHA-2 certificate thumbprints for trusted RDP publishers. Microsoft recommends that IT administrators migrate to SHA-256 or a stronger algorithm to avoid disruption.
Technical details
Data sheet · Security · Downloads · Components Click to collapse or expand
Data sheet
- Released
- 2026-07-14
- Classification
- Security Updates
- Type
- Cumulative update
- Restart
- Required
- Replaces
-
KB5093998, KB5087420, KB5082052, KB5078883
+53 earlier
KB5075941, KB5078132, KB5077797, KB5073455, KB5071417, KB5070312, KB5068865, KB5067112, KB5066793, KB5065790, KB5065431, KB5064080, KB5066189, KB5063875, KB5062663, KB5062552, KB5060826, KB5060999, KB5062170, KB5058502, KB5058405, KB5055629, KB5058919, KB5055528, KB5053657, KB5053602, KB5052094, KB5051989, KB5050092, KB5050021, KB5048685, KB5046732, KB5046633, KB5044380, KB5044285, KB5043145, KB5043076, KB5041587, KB5041585, KB5040527, KB5040442, KB5039302, KB5039212, KB5037853, KB5037771, KB5036980, KB5036893, KB5035942, KB5035853, KB5034848, KB5034765, KB5034204, KB5034123 - Replaced by
- KB5120240
| Version | Build | Channel |
|---|---|---|
| 23H2 | 22631.7376 | General availability |
Security
| Vulnerability | Severity | CVSS |
|---|---|---|
|
CVE-2026-32202
Exploited
Windows Shell Spoofing Vulnerability
|
Important | 4.3 |
|
Windows Secure Kernel Mode Elevation of Privilege Vulnerability
|
Critical | 7.8 |
|
SQL Server ODBC driver Elevation of Privilege Vulnerability
|
Important | 9.8 |
|
Windows FTP Service Remote Code Execution Vulnerability
|
Important | 9.8 |
|
Windows Push Notifications Elevation of Privilege Vulnerability
|
Important | 7.8 |
|
Windows NTFS Remote Code Execution Vulnerability
|
Important | 7.8 |
|
Virtual Hard Disk (VHD) Miniport Driver Elevation of Privilege Vulernability
|
Important | 7.8 |
|
Windows Local Security Authority Subsystem Service (LSASS) Denial of Service Vulnerability
|
Important | 7.5 |
|
Internet Key Exchange (IKE) Protocol Denial of Service Vulnerability
|
Important | 7.5 |
|
Windows NTFS Remote Code Execution Vulnerability
|
Important | 7.3 |
|
Windows App Package Installer Elevation of Privilege Vulnerability
|
Important | 7.0 |
|
Windows App Package Installer Elevation of Privilege Vulnerability
|
Important | 7.0 |
|
Windows WebView Elevation of Privilege Vulnerability
|
Important | 7.0 |
|
DirectX Graphics Kernel Elevation of Privilege Vulnerability
|
Important | 7.0 |
|
Windows Remote Desktop Security Feature Bypass Vulnerability
|
Important | 6.8 |
|
Windows Event Logging Service Information Disclosure Vulnerability
|
Important | 6.5 |
|
Windows File Explorer Information Disclosure Vulnerability
|
Important | 5.5 |
|
Windows Audio Service Information Disclosure Vulnerability
|
Important | 5.5 |
|
Windows Ancillary Function Driver for WinSock Information Disclosure Vulnerability
|
Important | 5.5 |
|
Windows File Explorer Information Disclosure Vulnerability
|
Important | 5.5 |
Downloads (Microsoft Update Catalog)
x64
23H2
1.1 GB
Arm64
23H2
1.2 GB
Updated components
2,679 files changed since the previous update for the same versions.
| Top changed components | Files |
|---|---|
| Remote Desktop | 40 |
| Graphics and display | 32 |
| Audio | 28 |
| Windows Update | 26 |
| Networking | 22 |
| File Explorer and shell | 21 |
| Bluetooth | 16 |
| Kernel | 13 |
| Search | 13 |
| Security and sign-in | 13 |
| Hyper-V and virtualization | 12 |
| Secure Boot | 12 |
Verified in package: changed files confirm Secure Boot, Country and Operator Settings Asset (COSA), Networking, Remote Desktop (RDP) Security.
Page history
-
Added CVE-2026-57084 (Important)
Sources
Updated
Cited passages from Microsoft's official notes (10)
-
1.
Secure Boot certificates used by most Windows devices are set to expire starting in June 2026.
support.microsoft.com -
2.
This update brings profiles up to date for certain mobile operators.
support.microsoft.com -
3.
In rare cases, some built-in Windows experiences that rely on previous hotkey lifecycle behavior might temporarily stop responding to certain keyboard shortcuts.
support.microsoft.com -
4.
applications that use sockets over unregistered third-party TDI transports might stop working after installing this update.
support.microsoft.com -
5.
This update upgrades the curl tool in Windows to version 8.21.0 and includes security improvements that help protect your device.
support.microsoft.com -
6.
This update makes quality improvements to the servicing stack, which is the component that installs Windows updates.
support.microsoft.com -
7.
After installing the June 2026 security update (KB5093998), these apps might fail to launch Office or open documents.
support.microsoft.com -
8.
An issue where the OneDrive shortcut in File Explorer stops working when File Explorer is run with administrative mode.
support.microsoft.com -
9.
This update addresses an issue where the confirmation dialog might display an internal Recycle Bin file name instead of the original file name when permanently deleting a file.
support.microsoft.com -
10.
Support for SHA-2 certificate thumbprints has been added for trusted RDP publishers, with SHA-1 support retained only for backward compatibility and planned for future removal.
support.microsoft.com
Checked automatically: 8 of 8 checks passed, 10 quoted passages · compared with Microsoft's page on Nov 8, 2026
- Quotes found in the official pages: passed
- Numbers found in the sources: passed
- Vulnerabilities from the dossier only: passed
- Links to allowed domains only: passed
- Every official change covered: passed
- Readable plain text: passed
- Changes confirmed by the file list: passed
- Sources agree: passed
A second AI read the text against the sources: correctness 3/5, clarity 3/5, completeness 4/5. How we work
Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake